fullcourtdefense-cli 1.21.9 → 1.21.11

package/dist/commands/login.d.ts

@@ -11,7 +11,7 @@ export interface LoginArgs {
  *
  * The machine authenticates to the org with a reusable fleet token (distributed
  * by IT/MDM), self-enrolls under its stable machine id, and receives a dedicated
- * per-machine Shield (monitor-first). Credentials are written to
+ * per-machine Shield (enforcing by default). Credentials are written to
  * ~/.fullcourtdefense.yml so no manual copy/paste of Shield IDs/keys is needed.
  */
 export declare function loginCommand(args: LoginArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/login.js

@@ -8,7 +8,7 @@ const machineIdentity_1 = require("../machineIdentity");
  *
  * The machine authenticates to the org with a reusable fleet token (distributed
  * by IT/MDM), self-enrolls under its stable machine id, and receives a dedicated
- * per-machine Shield (monitor-first). Credentials are written to
+ * per-machine Shield (enforcing by default). Credentials are written to
  * ~/.fullcourtdefense.yml so no manual copy/paste of Shield IDs/keys is needed.
  */
 async function loginCommand(args, config) {
@@ -58,7 +58,12 @@ async function loginCommand(args, config) {
     });
     console.log('');
     console.log(`\x1b[32m✓ ${result.reused ? 'Re-enrolled' : 'Enrolled'}\x1b[0m  ${result.shieldName}`);
-    console.log(`  Mode:    ${result.mode} (monitor-first — no blocking until you enable enforcement)`);
+    const modeNote = result.mode === 'block'
+        ? 'enforcing — dangerous actions and matching policies are blocked'
+        : result.mode === 'monitor'
+            ? 'monitor — actions are logged but not blocked'
+            : 'shadow — evaluation only, nothing is blocked';
+    console.log(`  Mode:    ${result.mode} (${modeNote}). Change it anytime from the dashboard.`);
     console.log(`  Config:  ${savedPath}`);
     console.log('');
     console.log('Next: \x1b[1mfullcourtdefense install-all\x1b[0m to wrap your MCP clients and install available runtime hooks.');

package/dist/commands/mcpGateway.js

@@ -1061,6 +1061,30 @@ function writeJsonMcpServer(file, serverName, nodeExe, commandArgs) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
 }
+// VS Code uses a DIFFERENT MCP schema than Cursor/Claude/Windsurf:
+//   - .vscode/mcp.json (and the user-profile mcp.json): top-level `servers` key.
+//   - settings.json: nested under `mcp.servers`.
+// Writing `mcpServers` (the Cursor/Claude key) leaves VS Code silently ignoring
+// the config, so the gateway never actually runs. These writers target the
+// correct key for each VS Code file shape.
+function writeVscodeMcpServer(file, serverName, nodeExe, commandArgs) {
+    const json = readJsonObject(file);
+    const isSettings = file.endsWith('settings.json');
+    if (isSettings) {
+        if (!json.mcp || typeof json.mcp !== 'object')
+            json.mcp = {};
+        if (!json.mcp.servers || typeof json.mcp.servers !== 'object')
+            json.mcp.servers = {};
+        json.mcp.servers[serverName] = { type: 'stdio', command: nodeExe, args: commandArgs };
+    }
+    else {
+        if (!json.servers || typeof json.servers !== 'object')
+            json.servers = {};
+        json.servers[serverName] = { type: 'stdio', command: nodeExe, args: commandArgs };
+    }
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
+}
 function removeTomlSection(content, tableName) {
     const lines = content.split(/\r?\n/);
     const out = [];
@@ -2206,10 +2230,7 @@ async function installVscodeMcpGatewayCommand(args, config) {
     if (targets.length === 0)
         targets.push(vscodeMcpPath(true));
     for (const file of targets) {
-        if (file.endsWith('settings.json'))
-            writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
-        else
-            writeMcpServerConfig(file, serverName, nodeExe, commandArgs);
+        writeVscodeMcpServer(file, serverName, nodeExe, commandArgs);
     }
     console.log('AgentGuard MCP Gateway installed for VS Code.');
     for (const file of targets)

package/dist/commands/onboard.js

@@ -419,7 +419,7 @@ async function onboardCommand(args, config) {
     const dashboard = (0, notify_1.consoleUrl)('/agent-security/users?view=desktop');
     console.log('');
     if (requiredFailures.length === 0) {
-        console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet (monitor-first until an admin enables enforcement).`);
+        console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet and enforces your policies (dangerous actions are blocked). An admin can switch it to monitor-only from the dashboard.`);
         console.log(`${DIM}Fleet view: ${dashboard}${RESET}`);
         console.log(`${DIM}Restart your AI clients (Cursor, Claude, VS Code, …) so they pick up the wrapped configs.${RESET}`);
         mark('verification', 'completed');

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.9"
+  "version": "1.21.11"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.9",
+  "version": "1.21.11",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {